lotterypuzzle atlas

Tools · kangaroo work estimator

What does a window cost?

Public-key methods (Pollard's kangaroo and its relatives) need roughly square-root work over a bounded interval. For a window of 2w scalars, the generic average-work estimate is ≈ 2·√N group operations — an explicit heuristic, not a benchmark, and a different unit from address-scanning candidates.

Input

Public-key target (open puzzles with a published key)

Width of the interval you would hand to a solver, in bits (2w scalars). Odd widths keep a half-bit in the work estimate: w=97 is 297 scalars and about 249.5 group operations, not a rounded 249.

Billions of group operations per second on your hardware — no benchmark is supplied here. Leave it empty to see the work estimate without a time. Group operations are elliptic-curve steps; they are not HASH160 candidate keys.

Estimate

Heuristic work

249 group operations

In figures
≈ 5.63×1014 expected group operations (heuristic, O(√N))
Target
#140
Catalog classification
open — public key known
Estimated time
Enter your own group-op rate (Gop/s) to estimate time — no benchmark is supplied.
Containment probability
1.14×10−13
Containment odds
1 in 8,796,093,022,208
Containment exponent
2−43

Only 1 in 8,796,093,022,208 of the interval sits inside a w-bit window: finishing a window run is not proof the key was inside it.

The method constant, plainly

≈ 2·√N, cited.

The van Oorschot–Wiener variant of Pollard's kangaroo has an average cost of (2+o(1))·√N group operations (Galbraith–Pollard–Ruprai, ePrint 2010/617). This estimator uses the constant 2. Other implementations quote 1.6–2.1 depending on their optimisations; none of those are our measurements.

No √(πN).

We do not quote √π ≈ 1.77 as a "classical" constant: it does not follow from the published VOW result, and it silently changes the answer. Use the cited constant above and switch it transparently if you have a reason.

Group operations ≠ candidate keys.

A kangaroo step is an elliptic-curve addition; an address scan hashes one candidate per step (one HASH160 each). Convert between them only with your own measurements, never by assumption.

Containment is not success.

The containment probability says whether the key lies inside the window. Whether a solver finds a contained key — in budget, without error — is a separate assumption you enter in the probability/EV tool.

A finished budget is not enumeration.

Completing a bounded run remains probabilistic: distinguished-point and runtime overheads raise the effective work, and finishing the ≈ 2·√N heuristic is not proof that every scalar in the window was visited.

Odd widths.

w=97 yields 249.5 group operations (≈ 7.96×1014), not a rounded 249. The estimator keeps half-bit exponents.

See also the range explorer for the exact intervals this window lives in, and method notes for the distinction between scanning and group-based search.